How to Install SSL on Zimbra

Securing your Zimbra server with SSL encryption is crucial for protecting sensitive data and ensuring secure communications. This guide will walk you through the steps to install an SSL certificate on your Zimbra mail server.

Prerequisites

• Access to your Zimbra server with root or sudo privileges.
• SSL certificate files (certificate, intermediate certificate, and private key).

Steps to Install SSL on Zimbra

Step 1: Upload SSL Certificates to Server

First, transfer your SSL certificate files to your Zimbra server. You can use SFTP, SCP, or any other method you prefer.

Step 2: Combine Intermediate Certificates

If you have multiple intermediate certificates, you need to combine them into a single file. Use the following command:

cat intermediate1.crt intermediate2.crt > intermediate_combined.crt

Step 3: Verify Certificates

Ensure that your certificates are correct and match the private key using the following commands:

openssl x509 -noout -modulus -in yourdomain.crt | openssl md5
openssl rsa -noout -modulus -in yourdomain.key | openssl md5
openssl x509 -noout -modulus -in intermediate_combined.crt | openssl md5

All three outputs should be identical. This confirms that the private key matches the certificates.

Step 4: Backup Existing Certificates

Backup the existing certificates on your Zimbra server before making any changes. This allows you to restore the original state if something goes wrong:

cp /opt/zimbra/ssl/zimbra/commercial/commercial.crt /opt/zimbra/ssl/zimbra/commercial/commercial.crt.bak
cp /opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt /opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt.bak
cp /opt/zimbra/ssl/zimbra/commercial/commercial.key /opt/zimbra/ssl/zimbra/commercial/commercial.key.bak

Step 5: Install the New Certificates

Copy the new SSL certificate files to the appropriate locations:

cp yourdomain.crt /opt/zimbra/ssl/zimbra/commercial/commercial.crt
cp intermediate_combined.crt /opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt
cp yourdomain.key /opt/zimbra/ssl/zimbra/commercial/commercial.key

Step 6: Deploy the Certificates

Deploy the new certificates using the following commands:

su - zimbra
zmcertmgr deploycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.crt /opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt
zmcontrol restart

Ensure you exit from the Zimbra user session:

exit

Step 7: Verify the Installation

To verify the SSL installation, open a web browser and navigate to your Zimbra webmail URL. Check if the SSL certificate is applied correctly without any errors.

Conclusion

Installing an SSL certificate on your Zimbra server enhances security by encrypting communications. By following the steps above, you can ensure that your server is correctly configured to use SSL.